Splunk SPLK-1002 Study Guide Archives Updated on Feb 03, 2024 [Q72-Q88] : Exams Labs Braindumps : http://blog.examslabs.com

QUESTION 72
Which of the following statements about tags is true? (select all that apply.)

Tags are case-insensitive.

Tags are based on field/vale pairs.

Tags categorize events based on a search.

Tags are designed to make data more understandable.

QUESTION 73
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

CIM is a methodology for normalizing data.

CIM can correlate data from different sources.

The Knowledge Manager uses the CIM to create knowledge objects.

CIM is ^n app that can coexist with other apps on a single Splunk deployment.

QUESTION 74
Complete the search, …. | _____ failure>successes

Search

Where

If

Any of the above

QUESTION 75
Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Events in the transaction occurred within 5 seconds.

It groups events that share the same clientip and host.

The first and last events are no more than 5 seconds apart.

The first and last events are no more than 30 seconds apart.

QUESTION 76
Complete the search, …. | _____ failure>successes

Search

Where

If

Any of the above

QUESTION 77
A space is an implied _____ in a search string.

OR

AND

()

NOT

QUESTION 78
The time range specified for a historical search defines the ____________ .——questionable on ans

Amount of data shown on the timeline as data streams in

Amount of data fetched from index matching that time range

Time range for the static results

QUESTION 79
Which of the following actions can the eval command perform?

Remove fields from results.

Create or replace an existing field.

Group transactions by one or more fields.

Save SPL commands to be reused in other searches.

QUESTION 80
Which of the following statements describes the use of the Filed Extractor (FX)?

The Field Extractor automatically extracts all field at search time.

The Field Extractor uses PERL to extract field from the raw events.

Field extracted using the Extracted persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

QUESTION 81
Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

| where 10yearAnnerversary=Renewal-MonthYear

| where ’10yearAnnerversary=Renewal-MonthYear

| where 10yearAnnerversary=’Renewal-MonthYear’

| where ’10yearAnnerversary’=’Renewal-MonthYear’

QUESTION 82
Which of these search strings is NOT valid:

index=web status=50* | chart count over host, status

index=web status=50* | chart count over host by status

index=web status=50* | chart count by host, status

QUESTION 83
Which of the following statements describes the use of the Field Extractor (FX)?

The Field Extractor automatically extracts all fields at search time.

The Field Extractor uses PERL to extract fields from the raw events.

Fields extracted using the Field Extractor persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

QUESTION 84
What are the two parts of a root event dataset?

Fields and variables.

Fields and attributes.

Constraints and fields.

Constraints and lookups.

QUESTION 85
What are the two parts of a root event dataset?

Fields and variables.

Fields and attributes.

Constraints and fields.

Constraints and lookups.

QUESTION 86
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Evenrches would return a report of sales by state.

Events will be returned from the data model named Application_State.

Events will be returned from the data model named All_Application_state.

No events will be returned because the pipe should occur after the datamodel command

QUESTION 87
Which are valid ways to create an event type? (select all that apply)

By using the searchtypes command in the search bar.

By editing the event_type stanza in the props.conf file.

By going to the Settings menu and clicking Event Types > New.

By selecting an event in search results and clicking Event Actions > Build Event Type.

QUESTION 88
Which of the following searches show a valid use of macro? (Select all that apply)

Option A

Option B

Option C

Option D